This invention relates to the authentication of entities and messages.
It is a common requirement to verify the authenticity of data which may represent monetary value or may imply the authenticity of the entity generating that data. A typical application where authentication is critical to avoid forgery is found in credit transactions using smart cards. For example, before a credit transaction is undertaken the authenticity of the smart card and/or value dispensed therefrom must be proved to the authentication device (such as data recording or transfer device) involved in the transaction.
To impede forgery only the entity source (for example, the manufacturer of a smart card) should possess the means to produce the authentication elements. This implies that the source must possess some secret. The difficulty in proving authenticity is in providing the means to the authenticator to achieve that proof. Many systems employ an algorithm driven by a secret key such that a data string passed through the algorithm results in a secret transformation of that data. The data so transformed is used as an authentication certificate or code which may be tested by an authenticator. One method of testing involves the authenticator in performing the same secret transformation of the data to yield an authentication certificate which is compared for equality with that provided by the source entity (for example, a smart card).
The problem with this technique is that the authenticator must duplicate the data manipulation by the source entity so as to compare the result for equality. This means that an authenticator can forge an authentication certificate and claim that it emanated from the source entity. Another problem is that the authenticator must also have knowledge of the key. This problem is particularly acute if several authenticators need to authenticate an entity, since each must possess the secret key. Disclosure of this key by one authenticator therefore compromises all authenticators and the source entity. Furthermore, the secret key must be securely distributed to each potential authenticator prior to the event. This therefore limits the ability to authenticate to only those trusted authenticators which were anticipated to require the function.
Where it may be necessary for a large number of unpredictable authenticators to possess the ability to authenticate another entity, the use of secret key algorithms is somewhat impractical. Further, when it is desirable that the authenticator be completely denied the ability to forge an authentication certificate the duplicative equality test method cannot be employed.
Another known technique employs the art of public key cryptography wherein an asymmetrical algorithm is used. Public key cryptography is described in the article: Communications of the ACM, vol. 21, No. 2, February 1978, pages 120-126, R. L. Rivest et al. "A Method for Obtaining Digital Signatures and Public Key Crypto-systems". In this known technique, a data element or a change sensitive compression of a data string is enciphered using a secret key or procedure. Authenticity is proven by obtaining the original data element (or change sensitive compression) which is used as a reference value and then using a public key or procedure to decipher the data supplied by the source entity. Equality of the deciphered data with the reference data implies that the secret key or procedure was employed and thus that the data is authentic.
This technique permits any authenticator to know the public key or procedure with which to prove the authenticity of data emanating from an entity possessing the complementary secret key or procedure. Consequently, the key distribution problem is significantly eased as prior knowledge and secrecy are not required.
However, the publicly known procedure must not permit the secret key or procedure to be easily determined. Generally, the algorithms possessing this property require substantial computing power to perform the secret procedure. This usually renders them unsuitable for low cost entities where operational speed is a requirement. If multiple portable entities or the data emanating from them must be able to be tested for authenticity, then the secret key and algorithm must be contained in each entity. In this case, disclosure of the secret key in one entity will compromise all similar entities.
This technique is therefore not practical for low cost replicated entities.
European Patent Application No. 0 252 499 discloses a method for creating a unique card identifier in the form of a "smart card" which involves selecting a modulus which is a product of two primes, preparing a string of information unique to the card identifier, utilizing a pseudorandom function to transform such string and a plurality of selected indices to derive an associated plurality of values which are quadratic residues with respect to the modulus, computing the square roots of the reciprocals of the quadratic residues, and recording the information string, such square roots and the related indices in the card identifier. Such card is authenticated by transmitting the information string and the selected indices from the card to a verification device and generating in the verification device the quadratic residues utilizing the pseudorandom function, selecting in the card a random number, computing the squared value of the random number and transmitting such squared value from the card to the verification device, generating in the verification device a random vector which is sent to the card, computing in the card the product of the random number and a selection of the stored square root values dependent on the random vector, transmitting the product to the verification device, squaring the transmitted product and multiplying such squared value by a selection of the computed quadratic residue values selected in accordance with the random vector, and checking that the result value is equal to the squared random number. This known method is complex and in particular involves the selection and utilization of quadratic residue values.